Elasticsearch

what does it mean

cdm                 Continuous Diagnostics Mitigation
cdm                 client data master

Add password to .netrc and use curl -n to use creds

~/.netrc 
machine localhost
login <username>
password <password>

count entries in index

GET /<indicie>/_count

get latest content from indicies.

curl -n -sk -X GET "https://localhost:9200/<index>/_search" -H 'Content-Type: application/json' -d '{
  "size": 1,
  "sort": [
    { "@timestamp": { "order": "desc" } }
  ]
}'

Stats of elasticsearch

curl -n -sk -X GET "https://localhost:9200/_nodes/stats/jvm?pretty"

Who is master

curl -n -sk -X GET "https://localhost:9200/_cat/master?v"

Are we recovering

curl -n -sk -X GET "https://localhost:9200/_cat/recovery?active_only=true"

List indicies by size

curl -n -sk -X GET "https://localhost:9200/_cat/indices?v&bytes=b&s=store.size:desc"

list shards by size

curl -skn "https://localhost:9200/_cat/shards?h=index,shard,prirep,store,ip,node&bytes=b&s=store:desc"

View 5 log entries from biggest indicie

curl -n -X GET "https://localhost:9200/<indicie>/_search?size=5&pretty"

Search for a string of a log entry in the biggest indicie.

curl -n -X GET "https://localhost:9200/.ds-logs-system.syslog-default-2022.08.22-000006/_search?pretty" -H 'Content-Type: application/json' -d'{
  "query": {
    "match": {
      "message": "<string>"
    }
  }
}' | jq -r .hits.hits[]._source.message

list snapshot setup

curl -n -sk -X GET "https://localhost:9200/_snapshot?pretty"

Look at snapshots

curl -n -sk -X GET "https://localhost:9200/_snapshot/elastic_snapshots_repo/_all?pretty" | jq -r '.snapshots | sort_by(.end_time)[] | .snapshot'

List indices inside snapshot

curl -n -sk -X GET "https://localhost:9200/_snapshot/elastic_snapshots_repo/daily-snapshots-2025.09.10-ctbhwxs5r4yl4okmthrilq?pretty" | jq -r '.snapshots[].indices | sort[]'

restore index

curl -n -sk -X POST "https://localhost:9200/_snapshot/elastic_snapshots_repo/<snapshot_name>/_restore" -H 'Content-Type: application/json' -d '{
  "indices": "<index_to_restore>",
  "ignore_unavailable": true,
  "include_global_state": false
}'

look at status of recover

curl -n -sk -X GET "https://localhost:9200/_cat/recovery?v&h=index,shard,stage,source_host,target_host,total,recovered,percent,recovery_type&bytes=b"

Remove all indices

curl -n -sk -X GET "https://localhost:9200/_cat/indices?h=index&s=store.size:desc" | while read INDEX ; do echo '*' "${INDEX}" ; echo curl -n -sk -X DELETE "https://localhost:9200/${INDEX}" ; done

Delete empty indices

# Delete empty indices
curl -skn "https://localhost:9200/_cat/indices?h=index,docs.count" | awk '$2 == 0 {print $1}' | while read idx; do
  curl -skn -X DELETE "https://localhost:9200/$idx"
done

count shards

curl -snk "https://localhost:9200/_cat/shards?v" | wc -l